Cobalt Strike "Beacon"

I received an email today, stating that someone or group had installed something called Cobalt Strike Beacon on all of my devices, and if I didn't pay they were going to release the information that they had "downloaded" to their servers. The email says it's from *** Email address is removed for privacy *** Any suggestions other than to in and change all of my passwords. Who should I pass this email onto?

Thanks

Here is a partial of the email:

			Greetings!<br><br> <br><br>I have to share bad news with you. Approximately a few months ago, I gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.<br><br> <br><br>Here is the sequence of events:<br><br> <br>Some time ago, I purchased access to email accounts from hackers (nowadays, it is quite simple to buy it online). I have easily managed to log in to your email account *** Email address is removed for privacy ***.<br><br> <br><br>One week later, I have already installed the Cobalt Strike "Beacon" on the Operating Systems of all the devices you use to access your email. It was not hard at all (since you were following the links from your inbox emails). All ingenious is simple. :).<br><br> <br><br>This software provides me with access to all your devices controllers (e.g., your microphone, video camera, and keyboard). <br>I have downloaded all your information, data, photos, videos, documents, files, web browsing history to my servers. I have access to all your messengers, social networks, emails, chat history, and contacts list.<br><br> <br><br>My virus continuously refreshes the signatures (it is driver-based) and hence remains invisible for antivirus software. Likewise, I guess by now you understand why I have stayed undetected until this letter.<br><br> <br><br>While gathering information about you, i have discovered that you are a big fan of adult websites. You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure. Well, i have managed to record a number of your dirty scenes and montaged a few videos, which show how you **** and reach orgasms.<br><br> <br><br>If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, colleagues, and relatives. Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you.<br><br> <br>I also have no issue at all with making them available for public access (leaked and exposed all data). <br>General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest. <br>I guess you don't want that to happen.<br><br> <br><br>Let's settle it this way:<br><br> <br>You transfer $1821 USD to me and once the transfer is received, I will delete all this dirty stuff right away. After that, we will forget about each other. I also promise to deactivate and delete all the harmful software from your devices. Trust me. I keep my word.<br><br> <br><br>That is a fair deal, and the price is relatively low, considering that I have been checking out your profile and traffic for some time by now. If you don't know how to purchase and transfer Bitcoin - you can use any modern search engine.<br><br> <br><br>You need to send that amount here Bitcoin wallet: <br>1LXXqKrRWSnFoXnN54Rwhrx1Z8kGX3aCRr<br><br> <br><br>(The price is not negotiable). <br>You have 2 days in order to make the payment from the moment you opened this email.<br><br> <br><br>Do not try to find and destroy my virus! (All your data is already uploaded to a remote server). <br>Do not try to contact me. Various security services will not help you; formatting a disk or destroying a device will not help either, since your data is already on a remote server.<br><br> <br><br>This is an APT Hacking Group. Don't be mad at me, everyone has their own work. <br>I will monitor your every move until I get paid. <br>If you keep your end of the agreement, you won't hear from me ever again.<br><br> <br><br>Everything will be done fairly! <br>One more thing. Don't get caught in similar kinds of situations anymore in the future! <br>My advice: keep changing all your passwords frequently.	<br>	---		<br>	---		<br>	---

Hello I got an exact same one with days tweaked and bitcoin amount. If anyone knows how to pass this on to the proper authorities so they can track the Wallet through bitcoin I´d appreciate it. (its not a completely anonimous and can be tracked) this blackmail letter was Received 23/02/21.

I do not plan on sending any coins/money and since I found this on Microsoft i´ll sleep much easier.

But i Recommend that you change your email password because I got another one a few years back with my email password which made me change all my passwords.

some thoughts on the email:

**1) they say do not contact, this is because they used a disposable email which dissapears after its been used ****@name.name.com which means you cant contact them even if you wanted to and its designed this way to avoid law enforcement.

2) they dont specify what you did, i.e., [quote: "you perfectly know what I mean"] just shows they dont actually know what you´ve been up to. Simply telling you what you have browsed in terms of categories/video name/ what you´ve searched for or what Webbsites you have frequented would have left them in no less of an incriminating situation because they literally talk about you " ****" and "Orgasming" and asking for compensation for removing sensitive material which already is a criminal offense.

3) No passwords were told because they have none, simply writing 2-3 passwords of the accounts they have access to wouldn´t change anything like nr.2

4) clicking links, most people dont even click on emails they dont recognize even less open it up and follow an unkown link to a webbsite they know nothing about.

5) also why would they have your email password if they sent an email? Because you would logically if you had the password log into the account, write an email to the email box and have it look like you sent it to yourself and not end up in the JUNK Email category to be deleted. You send you.

The previous blackmail letter i mentioned had it look like I sent it to myself, it had ended up in my regular email box, and it had my password but its easy to send an email from another email and make it look like it came from yourself.

6) Ill be monitoring you? That doesnt make any sense because they supposedly have everything backed up so reformating and looking for it would be pointless according to them but it begs the question.....why would they continue to monitor you?

**Logically first you cant find the virus because it doesnt exist, second if you already have the blackmail material why would you need to have a continous updating one that sends more incriminating material? You´d already be f-ed anyway at this point and not continue your activities thus not creating more ammo to the one who extorts you. Meaning all needed would be seeing the payment in the wallet to see that you complied with their demands which you shouldnt under any circumstances.**

7) Breaking the law? Last time i checked viewing erotica wasnt illegal and very few people browse the illegal kind on a conventional webbrowser so having law enforcement fine you or break down your door to arrest you is not going to happen. Theres a reason for darkwebb browsers and VPNs exists and grand majority of people dont have these.

8) "Access to all your devices", no specification of which devices they have access to, ill refer to the same logic as nr.2 and nr.3 letting you know if its phone, computer or tablet wouldnt change anything either. Also you´d have to click on the same link as you have with your other devices to have the virus installed. access to computer doesnt mean access to phone or tablet and vice versa.

9) lack of proof, if they have access to your devices/accounts etc.. the proof should be in places that requires access like saying I left proof wouldnt change anything refer to nr.2 again. A good example would be leaving a greeting in your draft box to let you know that they´ve gained entry. (something simple as a sign or an @ in an empty email would be enough) or even change something in a different account, most people have more than one inbox or account of some type they should logically have gained access to.

10) No follow-up, you would expect someone to follow up by showing that they have any type of access to your devices, making good on their threats is exactly how they would make their money by scaring you and showing they can make good on those threats.

They want something from you, not to waste their time watching you or montaging your sessions (I cant imagine even wanting to go through with this threat because people are gross, like this is where dedication to ruining someones life is worth pittying).

11) Monitoring you, if you read this the extortionist would let you know through email that they have seen your attempts in finding some re-assurance and while I´m Writing this I havent gotten any updates from my would be extortionist/scammer which in on itself lets me know that I´m not compromised in any way. So you got nothing to fear as the reader.

Conclusion:

This entire email is designed to schock and scare you into action within a short time-frame so you have nothing to fear.

But if under any circumstances you encounter something that shows you concrete proof that they´re in possesion of sensitive material like any of the suggestions ive made in my through thoughts 1-10, then maybe then you´d consider complying, just know that it will probably cost you more on later despite their word because given real blackmailers they always come back for more but i´d still suggest taking contact with the police instead.

This email is sent to a lot of people and is a numbers game and not just you, you havent been singled out and the list purchased illegally contains thousands of hijacked emails which makes it logistically impossible to manage on an individual level which is an re-assuarnce to the individual in question.

Im no computer analyst or IT-savy person myself but reflecting and looking at lack of details and inconsistencies is something im good at so here is some of the advice ill be taking myself after doing a littlebit of research on this topic.

Tips:

- Cover up your camera when not in use,

- dont click on email links that you dont know anything about,

- keep nudes and other erotic content off your devices

- store your most important documents in USB/chips and external harddrives.

keep

- Use a VPN

- Update your Virus protection programs

- And let authorities and Microsoft know about the email that was sent to you.

I hope this will ease some peoples worries because we shouldnt have to deal with awful people who do this, may it be from a third world country or a Sociopath of any age (Young or old) sitting in the US or Europe trying to score a quick buck. Just stay calm and analyze what you read and think twice before giving up on your hard earned cash.

So short-short all is well and you´re okay, just make sure that this is a wake-up call so you dont neglect basic IT-Security.

The blackmail letter is as following:

Greetings!

I have to share bad news with you. Approximately a few months ago, I gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.

Here is the sequence of events:

Some time ago, I purchased access to email accounts from hackers (nowadays, it is quite simple to buy it online). I have easily managed to log in to your email account ******@hotmail.com.

One week later, I have already installed the Cobalt Strike "Beacon" on the Operating Systems of all the devices you use to access your email. It was not hard at all (since you were following the links from your inbox emails). All ingenious is simple. :).

This software provides me with access to all your devices controllers (e.g., your microphone, video camera, and keyboard).
I have downloaded all your information, data, photos, videos, documents, files, web browsing history to my servers. I have access to all your messengers, social networks, emails, chat history, and contacts list.

My virus continuously refreshes the signatures (it is driver-based) and hence remains invisible for antivirus software. Likewise, I guess by now you understand why I have stayed undetected until this letter.

While gathering information about you, i have discovered that you are a big fan of adult websites. You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure. Well, i have managed to record a number of your dirty scenes and montaged a few videos, which show how you *yank* and reach orgasms.

If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, colleagues, and relatives. Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you.

I also have no issue at all with making them available for public access (leaked and exposed all data).
General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest.
I guess you don't want that to happen.

Let's settle it this way:

You transfer 1.2 Bitcoin to me and once the transfer is received, I will delete all this dirty stuff right away. After that, we will forget about each other. I also promise to deactivate and delete all the harmful software from your devices. Trust me. I keep my word.

That is a fair deal, and the price is relatively low, considering that I have been checking out your profile and traffic for some time by now. If you don't know how to purchase and transfer Bitcoin - you can use any modern search engine.

You need to send that amount here Bitcoin wallet:
bc1qxnmlfwe3zlmdhr74cs39vytxpxp4zuecmtvne2

(The price is not negotiable).
You have 5 days in order to make the payment from the moment you opened this email.

Do not try to find and destroy my virus! (All your data is already uploaded to a remote server).
Do not try to contact me. Various security services will not help you; formatting a disk or destroying a device will not help either, since your data is already on a remote server.

This is an APT Hacking Group. Don't be mad at me, everyone has their own work.
I will monitor your every move until I get paid.
If you keep your end of the agreement, you won't hear from me ever again.

Everything will be done fairly!
One more thing. Don't get caught in similar kinds of situations anymore in the future!
My advice: keep changing all your passwords frequently.

Its an scam, simply change your password(s), and don't reuse them on multiplie sites.

I have received it too even though I haven't gone to any porn websites and there has been tape over my laptop camera from the moment I bought the laptop. Spent time changing passwords today and looking at security. Now I realize this was just another phishing attempt. LOL